Summary

  • Researchers Talal Haj Bakry and Tommy Mysk disclosed three WebKit paths that can bypass an application-level proxy: DNS prefetch, WebAuthn Related Origin Requests and WebTransport.
  • The DNS-prefetch path can reveal the device’s ordinary DNS resolver; the WebAuthn and WebTransport paths can expose the device’s real IP address to a destination controlled by a site.
  • Mysk dates support for the relevant mechanisms to iOS 18.0 for Related Origin Requests, iOS 26.0 for DNS prefetch and iOS 26.4 for WebTransport.
  • TechCrunch independently tested the published proof of concept on 5 August and reported that it revealed the publication’s real address while Private Relay was enabled.
  • Apple documents Private Relay as a two-hop service for Safari browsing, DNS queries and some insecure HTTP traffic, not as a system-wide VPN.
  • Psylo 1.3.1 added local mitigations, but no Apple acknowledgement, CVE, platform patch or prevalence measurement had been established at the cutoff.

The common failure is ownership of the network request

Private Relay can handle the traffic it receives correctly and still fail to protect a browsing session as a whole. That is the central architectural point in the disclosure. Ordinary Safari page loads enter a path Apple describes as two separate relays: one side knows the subscriber’s address, while the other knows the destination. The three demonstrated requests do not follow that path. They are created by a resolver hint, an operating-system credential service or a separate transport implementation.

DNS prefetch leaks a resolver path, not necessarily the same fact as an IP leak

A page can include a dns-prefetch hint so the browser resolves a hostname before it is needed. Mysk reports that WebKit sends this lookup through the device’s ordinary DNS route rather than the configured application proxy. A site can make the hostname unique to a visitor and observe the query at an authoritative DNS server. The observation can identify the user’s real resolver and network context instead of the proxy’s resolver.

A DNS query does not automatically disclose the device’s exact public IP to the web origin: caching and resolver design affect what the authoritative server sees. It therefore should not be merged with the two direct-connection paths.

A passkey-related validation can run without a passkey ceremony

WebAuthn Related Origin Requests allow an organisation to use a credential across a controlled set of domains. Before accepting a different relying-party identifier, the operating system fetches a validation file from that domain. According to the researchers, this fetch belongs to the system credential service, not Safari’s proxied network stack, so the destination can see the device’s real address.

With conditional mediation, the page can trigger validation without a visible prompt or completed authentication. The control problem is its ability to cause an out-of-path fetch, not the user’s decision to sign in.

WebTransport opens a second data plane

WebTransport gives web applications low-latency streams and datagrams over HTTP/3 and QUIC. Mysk reports that WebKit builds this connection without carrying the browser session’s proxy configuration into the new transport. The server therefore receives a direct connection rather than one from the relay address. Unlike the DNS case, this is a destination-visible real-IP exposure.

The feature is useful for interactive applications, so a durable repair cannot classify every direct transport as malicious. A subsidiary connection must inherit the privacy route, be denied, or request an intelligible exception.

Apple’s own scope explains both the promise and the gap

Apple says Private Relay protects Safari browsing, DNS-resolution queries and insecure HTTP application traffic. It replaces the user’s source address with a relay address and preserves only coarse location. The service is deliberately different from a VPN, which generally tunnels traffic at system level. The researchers likewise say the three demonstrated paths do not affect VPNs in the same way.

Users should neither assume that every device packet is covered nor conclude that all Private Relay traffic is exposed. The two-hop path can still hide normal Safari requests while adjacent services create exceptions invisible to the user.

Application workarounds buy time; the platform owns closure

Psylo 1.3.1 blocks DNS-prefetch hints and disables WebTransport and WebAuthn by default, with per-silo opt-in. The researchers also contacted the Tor Project and Onion Browser developers. These application measures trade compatibility for containment without making the shared platform boundary coherent.

At the cutoff, Apple had not supplied a comment reported by TechCrunch, and no CVE or platform patch was established. The researchers said they had not pre-reported the issue, citing prior disclosure experience. Closure requires the platform to propagate a protected-context policy across DNS speculation, credential validation and new transport sessions.

Sources